Resolved by !4857 XMR retiring-vault migration has a liveness risk during churn because signing authority and observation/accounting authority are different sets. FROST signing for a migrate tx is based on the **source/retiring vault membership**. Nodes that have churned out hold old vault key shares and may still participate in signing the retiring vault’s XMR migration tx. This is useful for moving funds out of the old vault. Observed-tx accounting, however, is based on the **current active validator set**. Churned-out nodes may help sign and broadcast the external XMR transaction, but they do not contribute to the THORChain observation quorum once they are no longer active. For non-XMR chains this split is not an issue because all active validators can observe the external transaction directly. For XMR, the outbound observation depends on signing-time metadata, especially `SpentOutputRefs`. Current active nodes that did not receive the FROST signing result are not able to independently observe and attest the XMR outbound before quorum. **Example** Assume a 9-validator network: ``` old XMR vault / old active set: A B C D E F G H I churned out: A B C new active set: D E F G H I J K L active-validator quorum: 6 of 9 XMR FROST signing threshold: 6 of old vault members ``` The churn removal limit preserves the minimum old-vault continuity needed for BFT quorum: at most the removable minority is churned out, so enough old vault members should remain active to reach the observation quorum. However, for XMR migrations this leaves very little margin. If the remaining old-vault members are exactly the quorum set, then a single remaining node missing the FROST result, being offline, failing sidecar verification, or otherwise not producing a local observation can make the migrate tx unobservable by the active validator set. The migration tx is scheduled from the old retiring vault. FROST signing can be completed by any 6 old vault members, for example: ``` A B C D E F ``` After churn: ``` A B C are no longer active validators D E F remain active old-vault members G H I remain active old-vault members J K L are new active validators ``` For THORChain to accept the XMR migrate outbound, it needs 6 active-validator observations. Potential contributors: ``` D E F: old vault members, active validators, active FROST participants can observe if they received signing result/spent refs G H I: old vault members, active validators, non-active FROST participants can observe if they received the FROST result/spent refs J K L: active validators, new vault members not part of old/source vault FROST result broadcast need peer-provided spent refs before they can independently observe ``` In the best case, all `D E F G H I` receive the FROST result and produce local observations. That gives exactly: ``` 6 of 9 active-validator observations ``` This reaches quorum, but with no slack. If any one of `D E F G H I` misses the FROST result, restarts, fails sidecar verification, or otherwise does not produce a local XMR observation, quorum drops below 6. Peer-provided XMR spent refs from observed-tx attestation gossip are applied only after THORNode accepts the committed/quorum observation. That means `J K L` can receive and aggregate peer attestations, but they cannot use those peer-provided refs pre-quorum to seed their sidecars and independently add their own observations. Their refs are applied only after the quorum they could have helped form has already succeeded. **Why this matters** This creates a tight quorum condition for XMR migrations after churn: ``` initial quorum depends on current-active old-vault survivors new active validators cannot help unless they can import/verify spent refs pre-quorum churned-out signers cannot be counted for THORChain observation quorum ``` The problem is that XMR observation requires signing-time spent-ref metadata, while the nodes that need to vote after churn may not all receive that metadata through the FROST result path. **Desired direction** Current active validators should be able to safely acquire XMR spent refs before committed observation quorum, without allowing arbitrary peer data to mutate sidecar state unsafely. A safe fix should preserve these properties: - do not count churned-out nodes as THORChain observation voters - do not create a local attestation merely from peer-imported refs - verify the observed outbound matches a planned THORChain outbound/migration - verify peer attestation signatures over the exact ObservedTx+SpentOutputRefs - apply refs to sidecar with verification enabled - let the normal scanner/local observation path emit the node’s own attestation afterward This would allow new/current active validators to independently observe the XMR migrate tx and contribute to quorum, while keeping THORChain accounting gated by active-validator observations. # Parent / Umbrella Issue - [work_item:2897]+ # Linked / Child Issues - [work_item:2898]+ - [work_item:2899]+ - [work_item:2900]+ - [work_item:2901]+ - [work_item:2930]+ - [work_item:2908]+ - [work_item:2909]+ - [work_item:2896]+ - [work_item:2853]+ - [work_item:thorchain/devops/serai/1]+